DOMDIFFER

DOMDIFFER is believed to be an evolution of the NakedPages phishing kit. It has been used for widespread attacks targeting 2FA bypasses of corporate Google and Microsoft accounts.

Push discovered this variant in our detections in February 2026 just before its first major wave of activity in March 2026. There was a brief lull in activity until it came back as one of the most prevalent phishing kits across summer 2026. The high levels of detections during this period were mainly driven by phishing campaigns based on fake calendar events.

Relationship to NakedPages

There are multiple technical reasons for believing that this tool is an evolution of NakedPages, including:

• Several cases of overlapping domain infrastructure
• Similar phishing page URL structures
• Re-use of anti-bot gate template

In addition, global prevalence based on unique hostnames submitted to urlscan by month shows a trend with DOMDIFFER appearing as a successor:

Timeline of NakedPages variants and transition to DOMDIFFER

DOM patching with domdiffer.js

Google's protections for their account sign-in flow make it a more difficult target for phishing because simple reverse proxying is not possible. As a result, attackers had to adopt alternative approaches, typically relying on some form of browser in the middle attacks in which the victim is connected to and controls a remotely hosted browser.

The DOMDIFFER toolkit still relies on standard reverse proxying for targeting Microsoft (possibly based on Evilginx under-the-hood) whereas its Google phishing component uses a WebSocket to mediate real-time communications with a remote browser instance. Instead of using VNC or streaming images (cf. Laurseraph), the victim is interacting with fully cloned Google login HTML that is retrieved from the remote browser and updated by applying patches from a DOM differencing library. The domdiffer.js file used to calculate and apply DOM patches is a rename of the open-source diffDOM library.

URL patterns

The landing URL for the anti-bot gate uses an eight character token as a bare parameter. Microsoft phishing seems to use mixed case letters (e.g. ?MmJgwGIc or ?lYhcruff) and Google lower case hex (e.g. ?9f07215e or ?1df3dc22).

The victim email address is sometimes supplied in the ref parameter.

Network traffic

Google credential relay

The client page loads /socket.io-client.js (Socket.IO v4.8.3), /domdiffer.js (a bundled diffDOM) and /index.js. It then connects to the phishing server of a Socket.IO WebSocket handling the following server -> client events:

• domchanges carries diffDOM patches to be applied to the victim's browser.
• domreset to fully reset the current DOM.
• inputchange to pre-fill the email input from the autograb parameter.
• redir to redirect the victim to a different URL.
• updateBrowserUrl to update the visible URL using history.replaceState().

The victim's inputs are relayed to the remote browser session using the following client -> server events:

• inputchange
• click
• keypress
• selectionchange

Microsoft credential relay

As a relatively transparent proxy, the Microsoft sign-in flow follows the same requests as a login to the genuine Microsoft site:

• POST /common/GetCredentialType
• POST /common/login